Vulnerability identifier: #VU90603

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26688

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hugetlbfs_parse_param() function in fs/hugetlbfs/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/1dde8ef4b7a749ae1bc73617c91775631d167557
http://git.kernel.org/stable/c/80d852299987a8037be145a94f41874228f1a773
http://git.kernel.org/stable/c/22850c9950a4e43a67299755d11498f3292d02ff
http://git.kernel.org/stable/c/2e2c07104b4904aed1389a59b25799b95a85b5b9
http://git.kernel.org/stable/c/13c5a9fb07105557a1fa9efdb4f23d7ef30b7274
http://git.kernel.org/stable/c/ec78418801ef7b0c22cd6a30145ec480dd48db39
http://git.kernel.org/stable/c/79d72c68c58784a3e1cd2378669d51bfd0cb7498

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.